Welcome to Splunk Answers, a Q&A forum for users to find answers to questions about deploying, managing, and using Splunk products. Contributors of all backgrounds and levels of expertise come here to find solutions to their issues, and to help other users in the Splunk community with their own questions.

This quick tutorial will help you get started with key features to help you find the answers you need. You will receive 10 karma points upon successful completion!

People who like this

1 Answer

per_second is only valid for the timechart command. timechart always operates on some certain timespan - per_second in your scenario is calculated by taking sum of the byte count for that timespan and divide it by the timespan's amount of seconds.

Okay, I I get it now, but, unfortunately, this means this isn't going to help determine the bandwidth as I was hoping it would. This assumes that all data was transferred in equal amounts of time per second, which likely isn't the case. For example, all the data could have been delivered in the first second of the span, resulting in a spike closer to the sum rather than the average byte per second.

I don't see how per_second could operate in another way than it currently does.

If you want to determine some kind of max bandwidth that has been seen during an interval, then you would need the information in the event that you mention, i.e. not only how many bytes but also how many seconds. Without that information, it is as impossible for Splunk as for yourself to calculate that.

I agree--I was mis-interpreting what per_second meant. The IIS logs do have that information (a field called time_taken that is represented in milliseconds). So my challenge is how do I have one event add to the sum of multiple bins? For example, say I have 1 minute bins, and the time taken is 5 minutes, I would need to add 1 minute to each of the 5 bins. I've done a lot of reading of the documentation and I can't determine how to split one event into many.